Private PKI renewal · Fix available; preparation required
Check issuer references before upgrading the Private CA connector
Announced October 29, 2026. Sources checked November 2, 2026.
AWS disclosed an issuer-resolution authorization issue in its Private CA Connector for Kubernetes. The fix is in aws-privateca-issuer 1.10.1, released October 13, and EKS add-on 1.10.1-eksbuild.1. Requests that relied on lenient issuer matching can stop renewing after the upgrade.
Who it affects. Installations below those versions. Under certain conditions, namespace-scoped approval could allow certificates from an unauthorized cluster-scoped issuer. This concerns private certificate issuance, not public-TLS lifetime rules.
What remains uncertain. Impact depends on approval policies and resource configuration. Installing the fix does not establish that existing requests will renew correctly. There is no universal certificate-expiry deadline.
One next step. Have the Kubernetes certificate owner audit CertificateRequest, Certificate and Ingress resources for an explicit issuer kind matching AWSPCAIssuer or AWSPCAClusterIssuer, then upgrade and verify issuance and renewal.
Credential exposure · Advisory published; fix available
Pair the Kinesis producer upgrade with credential remediation
Announced October 30, 2026. Sources checked November 2, 2026.
AWS’s October 30 advisory covers credentials passed to the native child process in command-line arguments and written to logs when the Daemon logger uses DEBUG. Version 1.0.8 changes credential transport and logging; the fix was already available before this advisory.
Who it affects. Java KPL applications using com.amazonaws:amazon-kinesis-producer through 0.15.12 or software.amazon.kinesis:amazon-kinesis-producer below 1.0.8. This is a client-library issue, not a claim that Kinesis Data Streams itself leaked credentials.
What remains uncertain. Actual exposure depends on access to the host and logs. Raising the log level leaves process-argument exposure in affected versions. Upgrading does not remove credentials already recorded. Role-session revocation can affect other users of the same role.
One next step. Have the application and IAM owners move to 1.0.8 or later, migrating 0.x users to the software.amazon.kinesis package. Follow the advisory for long-term key rotation, role-session revocation where needed, and restricting or redacting affected logs.
Credential ownership · Generally available
Give public-monitoring findings a response owner
Announced October 28, 2026. Sources checked November 2, 2026.
GitHub public monitoring is now generally available for eligible enterprises. It attributes detected secrets in public GitHub content to an enterprise, including findings outside repositories that enterprise owns.
Who it affects. GitHub Enterprise Cloud with Secret Protection or Advanced Security, including data residency. Attribution uses enterprise membership or verified domains; data-residency enterprises use verified-domain matching only. It does not scan private repositories.
What remains uncertain. Attribution and supported validity checks help triage; they do not guarantee complete credential discovery or replace provider-side remediation. Dismissing a finding does not rotate the credential.
One next step. Have the enterprise security owner review eligibility and verified domains, then assign a response path for findings: identify the credential owner, assess exposure, and record any provider-side revocation or rotation separately from alert closure.
Related
Where to go next
Certificate trust, CLI tokens, and a revised workflow deadline